1
$\begingroup$

I've read the CBC-R description from Rizzo & Duong but am having trouble understanding the sequence of steps that would be taken when the IV is unknown and is not included with the ciphertext.

Suppose I want to send a two-block ciphertext such that block 1 decrypts to garbage and block 2 decrypts to my desired plaintext. Would the following work? If so, why not?

  1. Pick a desired plaintext, call this P
  2. Create a random block, call this R1
  3. Send the random block to a padding oracle decryption routine, call the result D1
  4. XOR D1 with P, and make this block 1
  5. Use R1 as block 2

Since the IV is unknown the first block becomes garbage, but the during decryption the next block should decrypt R1, yielding D1, then XOR it with my block 1 to get back to my desired plaintext. Am I looking at this correctly?

Side question: I assume plaintext (step 1) should include any padding sequence that the server expects, e.g. PKCS#7. Or should this be somehow applied during step 5?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
0
$\begingroup$

Yes, you are correct. For padding - there's no way to fix it at step 5, you need to make correct padding at step 1.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.